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today, June 2, through neTl^ J" ERT callout whi <* may occur sometime from 

situation which involves FBI HQ components who are calling ihe shot"™" * b<?C3USe ^ iS 3 r3pidly deve,0 P in 6 

This is not a drug search but ratteTmo^ and ^ tom obile search in the Augusta area, 

to make sure we do it right. 1 mputer related search. Not a high risk search but need 


Please let me know you availability for the search. 
Thank you. 

Chuck McKee 


i 
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Mckee, Charles E. (AT) (FBI) 


From: 

Sent: 

To: 

Subject: 


Mckee, Charles E. (AT) (FBI) 
Friday, June 02, 2017 12:46 PM 
Granith, Kimberly C. (AT) (FBI) 
RE: ERT Callout 


I hanks. |'|| 


guv you as much notice as possible 


.Original message. 

from: "Ciranieh. Kimberlv 0 (AT) (I HI)" 
Date: 06/02/2017 12:00 [>M (Ci,YU-0v<)0) 

(AT) (I HI)" 

Siii>jcci: RIs "'Tcalloui 



"Kirkland. Marcus (AT) (FBI)' 


.~.... 

Kim 


von 


. ( higinal message. 

I rom: "Ylekee. Charles I . (AT) (I-'BI>" 
Date. 06/02/2017 11:50 AM ((iMT-05:()(fl 
i °J_Kirkland. Ylareus (AT) (FBI)" 


<1 


"M * 


^hdinson. KiinbcmM^^M^^^I) 

S/.c/.epnmjki^riai^|^\-|) (FBI)" < 


Reynolds. | luberl .1, (AT) (I Bl)" 



■ "Klealee. Thomus^^^V^^^^^- 



"Ciranieh. Kimberly C. (AT 


ulsc Ll ,nc knmv you availability f or j| k . sc;irc |, 
I’liank vou. 


1 
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Mckee, Charles E. (AT) (FBI1 



From: 

Sent: 

To: 

Subject: 


Mckee, Charles F. (AT) (FBI) 
Friday, June 02, 2017 1:32 PM 
Szczepanski, Brian J. (AT) (FBI) 
RE: ERT Callout 


I I'll give you as much notice as possible. I lave a sale re 


return. 


.Original message. 

I rom: Szc/.epanski. Brian J. (AT) (PHI)" • 
Dale: 06/02/2017 1:30 |>M (GMT-05:00) 
lo: 'Mckee. Charles IF (A I) (PHI)" • 
Subject: RI F l-RT Callout 



u!'.w k I'hi'lr Al ' in ralil ' 0mi “ , isl " 1 ... 'vork Moiuliiy and « 

Brian 


m help then irneedeil. I,el 


me 



.Original message. 

From: "Mckee, Charles IF (AT) (I BI)" 

Date: 06/02/2017 8:50 AM (CM I -08:Oo' 

lo: Tvirkland. Marcus (AT) (FBI)" , 

- - 1 "lolmson ' Reynolds, I lubcrt .1. (AT) (l ; B|)' 

——i-Lv ^ki. Bnl l j^ ! }wJHHHHKiI2! ! r nich ' Ki "> bCT 'y cai > 

)(IBI)"“"- 



. "Mealee. I honias\T(^^T 



C'al lout 


1 kiise Id me know you availability for ihe search. 
I hank you. 

( buck McKee 


1 
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Mckee, Charles E. (AT) (FBI) 



From: 

Sent: 

To: 

Cc: 

Subject: 


Mckee, Charles E. (AT) (FBI) 
Friday, June 02, 2017 1:46 PM 
Johnson, Kimberly J. (AT) (FBI) 
Allen, Jeffrey M, (AT) (FBI) 

RE: ERT Callout 


I lionks. I’ll give you as much notice as possible 



.Original message. 

I loin, Johnson. Kimberly .1 (A I ) (l-BI)" | 

Date: 06/02/2017 1:37 I’M (CiM I -05:00) 

I o_"Mekee. Charles H. (AT) (I MI i" .... ■ , . 

ii .. . K-nkland, Marcus (A I) ( I'Rh' 

Rey nolds. Iluberl .1. (ATOP MIC' 

K,mbai > 

_ 1<niaS ’ !) •»■■■■>>. "Mien. JefTrey M. (AT) (Mil)" 

Subject: RI-: l-RT Callout 

< hack. 


! * 1,n 1)01 available either today or tomorrow Inn will | )c -iv iil ihlt' »•, » 

. .* . -.-.-. 

I hanks. 

Kim 

KimhcrK .1. Johnson 
Forensic Accountant 
I e dei a I bureau ol Investigation 

•"SSKT"'. 


—< triginal Message- 

I lour Mckee. Charles R. (AT) (I BI) 

Nem: Friday. June 02. 2017 I I so ,\M 

Kirkland. Marcus (A | ) (Flip |’ \ | - 

r (A F) (FIJI) Johnson. Kimberly 

Sze/cpnnski, Brian J. (AT) ft-HI) 


( i OuTTs, Mccarthv T A. (AT) (I MI) 
(A i Mi ni, —- 

Subject I K I Callout 


P‘ : Can iek. Justin C (AT) (I'MI) j. 


■; Men fee, Thomas M. 


... .. ..’. . .-.* fc ~.. . . .. . . . 


I 
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I IQ components who arc calling the shots" ^ Ullknwwn da,e ,s bccillisc ll,ls is il rapidly developing situation which involves FBI 

dn,SSCi "' Ch bM ‘ ra,hcr and amSte^bmdhigh dj"7? ,hc | Au 8« s,aarca - ™* hnot a 

cti. Not a h igh . isk search but need to make sure we do it right. 

lease let me know you availability for the search. 


I hank vou. 


Chuck McKee 


?. 


Case l:17-cr-00034-JRH-BKE Document 235 Filed 02/27/18 Page 7 of 62 


Mckee, Charles E. (AT) (FBI) 


From: 

Sent: 

To: 

Subject: 


Mckee, Charles E. (A I) (FBI) 
Friday, June 02, 2017 3:02 PM 
Kirkland, Marcus (AT) (FBI) 

RE: ERT Callout 


is looking like loinomnv morning when wc will do ii. I will lc, y „u know nn.ro 


in ;i lew hours. 


.Original message. 

I mm: "Kirkland. Marcus (AT) (FBI)" 
Dale: 06/02/2017 12:00 |»M ((iMT-05:offi 
^^"^kee. CCharles E, (AT) (FBI)" 



( _ c: Bnils, MecaiTiiy^^^T) (1*131)" 


"Johnson. . 

** ’’S/e/epanski. Brian .1, (AT) (I^^T 


^ "|^vn<>lds. Iluberl .1. (AT) (I 111)" 


"Oranicli. Kimberly C. (AT) 



"Mcafce, Thoma^M^^T^^^^ 
allout 


"(iarriekAmstm 


.* Original Message- 

I rom Mckee. C harles I (AT) (I B|) 
V*nl: I ridav. June 02, 2017 I 1:50 .\v| 
1 o; Kirkland, Marcus (A I) (FBI) 


,—Johnson, Kimberly 
: S/c/epanskt. Brian .1 (AT) (Nil) 

'• Meafee. Thomas M 


I Kilo Southern I vain. I wanted u> lei you know Dial we mav Inve in Fin . u , 

through next I uesday, June 6. I his reason lor the unknown d He is I) . \f w, " c . h ,na .v sometime from today. June 2, 

I IQ components who are calling the shots. 1 " s ls ;l r;l|1,lllv developing situation which involves FBI 

I Kase let me know you availability lor the search. 

I hank you. 


i luick McKee 


i 
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Mckee, Charles E. (AT) (FBI) 



From: 

Sent: 

To: 

Cc: 

Subject: 


Mckee, Charles E. (AT) (FBI) 
Friday, June 02, 2017 7:21 PM 
Kirkland, Marcus (AT) (FBI) 
Butts, McCarthy A. (AT) (FBI) 
PE: ERT Callout 


limC .. . A " SUSm . .. —will affect nrrcs, and 

I'lcasc reply back to acknowledge that you arc good will, this pit,,,. 

Chunks. 


Chuck McKee 


.— < Iriginal message. 

I iom: "Kirkland. Marcus (AT) (FBI)" - _ 
Date: 06/02/2017 3:32 PM (GMT-05:00) 
lo: "Mckee. Charles F. (AT) (FBI)" 
Suhjccl: RF: ERT Callout 


Before I leave the office today, are there 


any items, equipment. 


etc. I need to take home with me. 


From: Mckee, Charles E. (AT) (FBI) 
Sent: Friday, June 02, 2017 3:02 PM 
To: Kirkland, Marcus (AT) (FBI) < 
Subject: RE: ERT Callout 



...’riling when vve wilt do it. | will tel you .. . .,, w 


* . ( Original message. 

I rom: "Kirkland. Marcus (AT) (FBI)" 
Date: 06/02/2017 12:00 I>,V| (GMT-05;00 

* F. (AT) (FBI)" 


( c; Dulls. McCarthy A. (AT) (FBI) 


^Johnson, KimTcHO^^^^^^)" * DI BI) 

“N "S/c/epanski. Brian .1. (AT) Kimberly C. (AT) 


P (larrick. Justin 


i 
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— I,,, r> - "Mcalcc. I humus M. (AT) (I HI)" 

SnhK-ct: RI-.: I Id Callout 

Ini in Jusi lot me know. 

()riginal Message. 

l-rom: Mckce. Charles I!. (A I) (I-Ml) 

• < ’ cn,; I ritlay, June 02. 2017 1 1.50 AM 
I o: Kirkland, Marcus (AT) (Hill ,, 

J (AT) (FBI) ■ Rc >' nw,ds - 1 hiben 1 (AT) (FBI 

— ^^^^™****^^ . (iRinieh, Kimberly C, (AT) (FBI) 

l ^" P *^^iccanh^ F (AT) (FBI) n 
(A I Ml-Bi) - 

Subject: I K I Callout 



■; Ciarriek. Juslin c. (A I) (FBI) 


: Johnson. Kimberly 
panskiTBrian J. (AT) (FBI) 

Mcafee. Thomas M. 


-taSSSisr i: « r„, 

IMea.se lei me know you availability for die search. 

I hank vou. 


' buck MeKee 
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Garrick, Justin C. (AT) (FBI! 



From: 

Sent: 

To: 

Subject: 

Follow Up Flag: 
Flag Status: 


Homburg, Michael B. (WF) (FBI) 

Saturday, June 03, 2017 7:37 AM 

Rich'oiiverT'(ATWFRIMH' Mlchael F - (CD > ( FB D.‘ Crosse, Natalie V. (OGC) (FBI); 

cn * UMVer L < AT ) (FBI); Harrison, James T. (AT) (FBI) 

Subject interview and polygraph authority 

Follow up 
Flagged 


Justin, 


»rorci 8 „ 

currently planned. ’ ^ 1 JU 101 llJ ls ctl ' 4 understands a polygraph is not 


I will document the above in an l-C when I 


am in the office. 


Mike 


i 
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Mckee, Charles E. (AT) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


Mckee, Charles E (AT) (FBI) 

Saturday, June 03, 2017 8:2-1 PM 
Kirkland, Marcus (AT) (FBI) 

S^ATwrro, n T ’ (FB,,; T'" Ce ' T " 0,, ' aS M - ,AT > ™ Bryngelson, 

iviatk (A!) (Il-O), Harrison, James T (AT) (FBI) 

RE: ERT Callout 


Search team. 

*** ^ ,,mv ° 
Chuck McKee 


proven to 


.Original message. 

I rom: 'Kirkland, Marcus (AT) (HHI)" 
Date: 06/02/2017 7:28 l>M (GMT-05:00) 
Io: "Mckee. Charles H. (AT) (I HI)" <c~ 
mkirklanckr/'lbi.gov: • 

( c: "Bulls, McCarthy A. (AT) (I'HI)" * 
Subject: RH: HR I Callout 



s "Kirkland. Marcus (AT) (I'HI)" 


'm good. 



.Original message. 

I rom: "Mckee. Charles H. (AT) (I'HI) 

Date: 6/2/17 7:20 I'M (GM 1-05:00) 

I o: "Kirkland. Marcus (AT) (I'HI)" < 

( e: "Hulls. McCarthy A. (AT) (I'HI)" 

Subject: RH: HR I" Callout 

Ac are having a 10:00 AM rally time at the Atmusla I HI „m iv , „„ .. . ... 

ilicn our search team will begin. 1 ollow ‘ Agents will affect the arrest atul 

I’let.se reply back to acknowledge that you are good with this plan. 

I hanks. 


( hlick McKee 


1 
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. ( Original message. 

*' rom: Kirkland. Marcus (AT) (I HI)" - J _ 
Date: 06/02/2017 3:32 PM (GMT- 05 : 00 ) 

* 0; "Mekec. Charles K. (AT) (I B()" < 
Subject: R\i: KRT Callout 


' ' NVe “* °" iW ,0d,1V - “ ""V «w™*. «c.. Heed ,o home w„h 


From: Mckee, Charles E. (AT) (FBI) 
Sent: Friday, June 02, 2017 3:02 PM 
To: Kirkland, Marcus (AT) (FBI) 
Subject: RE: ERT Callout 


It is looking like tomorrow morning when we will do il I will i, L 

'ill let you know more in a lew hours. 






.Original message. 

I rom: Kirkland. Marcus (AT) (I• IiI)" 
Date: 06/02/2017 12:00 PM ((iM I- 05 ; 
lo: "Mckee, Charles T. (AT ) (1-Til)" 

'Johnson, Kim 


c aiiotil 


' ^^XjMjdsMIubert .1. (AT ) (l-'BI)" 

Kimberly C. (A 

. "Ga 

)' 


im in Jusi lei me know. 


. ( Original Message. 

I rom. Mckee. Charles I*. (AT) (FBI) 
Son,: Friday. June 02, 2017 I I;so am 
lo: Kirkland, Marcus (AT) (FBI) 

J (AT) (FBI) “ 



crmMmrnmwA-nmi) 

(A I) (FBI) -— 

Sub jeer IK T 


m ; nolds, I lu herl J. (AT) (FBI) * 

l rly C\ (A I ) IW) 

: Ciarrick. Justin C\ (A I ) (FBI) 



Johnson, Kimberly 
Szc/epanskl. nrian J. (AT) (FBI) 

Mcafee, I homas M 


;! ( 7 ugh ,,cm Tuwida > ; -^ S'fhe , m!i^ou!; , d.!;ris 1 T kml whichmayoccur ^ ^-> 

IIU components who are calling the shots. d, “ l ' S ,h,s » :l ™P“% developing situ,,ion which involves FBI 

i '"' e ... sstn?, *«* 

01 *' '" gh " sk stnrch •’«« need to make sure we do ii right. 
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Please let me knpw you availability for the search. 

Thank you, 

Chuck McKee 






l 




3 
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Garrick, Justin C. /ATI (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 

Attachments: 


Harrison, James T. (AT) (F BI) 

Friday. June 02, 2017 7:37 PM 

o,iw ' e - iat) ** *-■*•*-* ■*«*> «at. <™, 

Fwd: Ops Plan 

Ops Plan-BattleRow.docx 


Follow Up Flag: Follow up 

F,ng Status: Flagged 


i — «*. *... 

Pocke, and all loose ends ,ied up well execule S11 n "T”? ' ^ ° ncc ^ suhj in 

don’i arrest. That’s our plan for now si-indinu hv Ihr r , ° n Suh -' alter completion of search ifwe 

Push an\ media inquiries Sieve Pmmeu # ' CO " ,aCt ,h " u » h " have a 1300 tee-time). I plan to 


()liver/( il)| 


- Justin has done a fantastic job pulling this oi l'in 24 hours. 


.Original message. 

I rom: 'Taylor. R. W. (AT) (I'MI)" < 
Date: 6/2/17 2:23 PM (GMT-05.00) 
lo: "Harrison. James T. (A I j (I BD 
Subject: Ops Plan 



Wallace I.in lor 
Special Agent 
I Ml - Augusta 
Ollicc 722-3702 


! 
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Garrick, Justin C. (AT) (FBI) 



From: 

Sent: 

To: 

Cc: 


Subject: 


Harrison, James T. (AT) (FBI) 

Saturday, June 03, 2017 3:55 PM 

Turner. Lisa; Solari. Jennifer (USAGAS); Edelstein, Julie (NSD) (JMD) 

v::’ H ° mb ■*» •**«.. m Gra « 

Mntlhew E. (CD) „ B „;' Sum. Richard S ^ T '< AT ’ <™ ,; 

Re: RLW Search Warrant Affidavit 


Follow Up Flag: 
Flag Status: 


Follow up 
Flagged 


Initiating contact now. Will execute SW in a 


lew 




I'dclstcin. Julie (NSD) (JMD)" 


, "I Ipmburg. 


CtUcIi Warrant Affidavit 


nrrick, Justin C. (AT) (FBI)" 

. "Cirossc, Natalie V. (OCiC) i 
son, James I . (AT) (FBI)" 
"Scott. Richard S. 


Any updates? 


Thanks, 

Lisa 

Lisa M. Turner 

Associate General Counsel 

Litigation 




From: Solari, Jennifer (USAGAS) fmailto: 

Sent: Saturday, June 03, 2017 01:32 PM 
To: turner, Lisa; Edelstein, Julie (NSD) (JMD) 

——Bo rea s, Ethan I .: Garrick, Justin C. (AT) ( 

; Grasse, Natalie V. (OGC) 
, James T. (AT) ( 

; Scott, Richard S. (N 
rch Warrant Affidavit 


( 

GC) 


burg, Michael B. (WF) (F 
; Rich, Oliver E. (AT) (FBI 
Matthew E. (CD) (I 


All, 


i 
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Garrick, Justin C. (AT) (FBI) 



From: 

Sent: 

To: 

Cc: 


Subject: 


Harrison, James T. (AT) (FBI) 

Saturday, June 03, 2017 4:09 PM 

(urner, Lisa; Solari, Jennifer (USAGAS); Edelstein, Julie (NSD) (JMD) 

Na^^GcS'Str Mid " el 8 W ™ <*** 

Matthew E. (CD) (FBI); Scott. Richard S (NSD) (JMD)' 5 ° n ' Jam6S ^ (FBI) ’' Th ° mps ° n ' 
Re: RLW Search Warrant Affidavit 


Follow Up Flag: 
Flag Status: 


Follow up 
Flagged 


Residence secure. Initialing search. W 
\ icc I HI office. 


appc " re hc "X’lWW'w hut ..pled lo he imerviewed in residence 


.Original message 

I mm: "Turner. I.isa _ 

b'3/l 7 3:53 PMTOTO 5 I 00 ) 
"• s °k»ri. Jeimilor (I S.\(i.\S)" 


"licit 



eas, Ethi 


Cc: 

Michael M. (Wl ; ) (FBI)" <_ 

■'Kicli. Oliver E. (AT) (FBI) 

Matthew R. (CmTntn 


Subject: Re: RI.W Search Warrant AHIdax 



>. "Hdclstcin. Julie (NSD) (JMD)" 
Garrick. Justin (’. (AT) (I'MI)" <j 

" (irossc - Na,a|ie v. (ogchfSJ 

miles T. (AT) (FBI)" _ 

’Scoli. Riehard S. (Msi)) (JiVIF)*^ 


"I lomburg. 


Any updates? 

Thanks, 

Lisa 

Lisa M. Turner 

Associate General Counsel 

Litigation 




From: Solari, Jennifer (USAGAS) [m q 
Sent: Saturday, June 03, 2017 01:32 PM*-™ 

To. I urner, Lisa; Edelstein, Julie (NSD) (JMD) 

Cc: Andreas,.Ethan-T.i_Garrick, Justin C. (AT) 

Grasse, Natalie V. ( 

, James T. (AT) (FBI 
Scott, Richard S. (NSD) 
Warrant Affidavit 


burg, Michael B. (WF) (f 
Rich, Oliver E. (AT) (FBI 
Matthew E. (CD) ( 


i 
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Garrick, Justin C. (AT) (FRT) 



From: 

Sent: 

To: 

Cc: 


Subject: 


Follow Up Flag: 
Flag Status: 


Harrison, James T. (AT) (FBI) 

Saturday, June 03, 2017 5:20 PM 

AndTas L Etlnn l r- G J r ni |[ er | (USAGAS); tdeislein ' Julie (NSD) (JMD) 

Nalalie V. (OGC) ?FB»*ch^r F^T )^ ^ « Crosse. 

M«,,,,ew , (CD) (FBI), ScoM, Richard S. (NSD,(^(T"’ ^ 

Re ,%LW Search Warrant Affidavit 

Follow up 

Flagged 


...... .-*. . „ . 




.Original message 

l-'rom: "Turner. I.isa" 

Dale: 6/3/17 3:53 I’M 
I o: "Solari 1 "* 


id 


\\ 


HI) 


Ol 


>. "Ivdelslein. Julie (NSD) (JMD)" 


’• (AT) (1-1)1)" 
osse. Natalie V. (OGC) 

imes T. (AT) (I’BI)" 
"Scott, Richard S. ( 


inani Allidavil 


g- 


Any updates? 


Thanks, 

Lisa 

Lisa M. Turner 

Associate General Counsel 

Litigation 




From. Solan, Jennifer (USAGAS) [mailto- 
Sent. Saturday, June 03, 2017 01:32 PM 
°. Turner, Lisa; Edelstein, Julie (NSD) (JMD) 
CcAndreas, Ethan T.: Garrick, Justin c (AT)( 

Grosse, Natalie V. (OGC) 
, James T. (AT) (FBI) 

, Scott, Richard S. (NSD) 
Warrant Affidavit 


burg, Michael B. (WF) (f 
Rich, Oliver E. (AT) (FB 
Matthew E. (CD) ( 


l 
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From: 

To: 

Subject: 

Date: 


Rich, Oliver E. Jr. (AT) (FBI) 

Solari. Jennifer fUSAGAS) 

FW: Case funds 

Monday, February 26, 2018 2:18:34 PM 


From: Homburg, Michael B. (WF) (FBI) 
Sent: Friday, June 02, 2017 7:16 PM 


To: Rich, Oliver E. (AT) (FBI) 
Cc: Varacalli, Michael F. (CD) 



; Haertel, Paul H. (CD) (FBI) 



Subject: RE: Case funds 

Oliver, 

This email confirms CD-4 will coordinate the enhancement of FBI Atlanta's budget, provide a TR#, or 
coordinate with CIRG to cover the costs associated with the deployment of surveillance assets for 
this matter. 

CES/USAO have indicated a PC arrest would be potentially authorized if the subject decides to flee so 
please plan accordingly (to cover with fisur and for arrest if authorized). 

I am also in the process of obtaining declassification for information in the affidavit. Will include you 
on the email so we can start discussing timing. I believe the USAO and CES planned to start fresh in 
the AM to finalize the warrant. 

Mike 


From: Rich, Oliver E. (AT) (FBI) 

Sent: Friday, June 02, 2017 6:21 PM 
To: Flomburg, Michael B. (WF) (FBI) 

Subject: Case funds 

Mike, 

We are deploying surveillance teams to SE Georgia this weekend. We will need a funding 
enhancement to cover tdy expenses. I will get you an estimate. 


Thanks, 

Oliver 
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DEFENDANTS 
| EXHIBIT NO. y. 


CASE NO. 


lilts QOO&f 


i 


US 


vs. 


(Avui0 / 


I 


MARKED FOR IDENTIFICATION 

QlQg 


FILED IN EVIDENCE 
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US 

vs. 


I 

'Jl 

1 twoc 

MARKED FOR IDENTIFICATION | 

Irm.’XL i Q1 _! I 

FILED IN EVIDENCE 

A 1 

A 

SCOTT tfrstfj, 


WK 
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defendants 
lEXHUStf NOjj^ 



SGASENO. 


VS. 


marked for identification 

^ I q 3 
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DEFENDANTS 
EXHIBIT NO. r? 

. • V . . - . ... • 


CASE NO. 

1*1 / i 

t.»2- <yoo3rf 



us 

vs. 

UJi/ine /" 

MARKED FOR IDENTIFICATION 

-SO 

FILED IN EVIfeflENCE 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

Southern District of Georgia 
In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No. l-HMWU 

1957 BATTLE ROW. AUGUSTA. GA 30904; ) 

A LIGHT COLORED NISSAN CUBE WITH VIN \ 

JN8AZ2KR0CT254476, and the person of REALITY LEIGH WINNER ' 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of Georgia 

(identify the fterson or desert be the property to be searched and give its location K 

See Attachment A. 


I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before June 17, 2017 < not to exceed 14 days) 

Sf in the daytime 6:00 a.m. to 10:00 p.m. □ at any lime in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventors to Hon. Brian K. Epps, United States Magistrate Judge 

(l nited States Magistrate Judge I 

□ Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who. or whose 
property, will be searched or seized (check the appropriate box / 

D for days (not to exceed Mh D until, the facts justify ing. the later specific date ofi 


Date and time i 

Citv and state: 


: issued: cjMn 



Ajt6\ 


Augusta, Georgia 



Judge 'sffignutun 


Brian K Epps, United States Magistrate Judge 

Printed name and title 





ATTACHMENT A 

Property to he searched 

The premises to be searched, 1957 Battle Row. Augusta. GA 30904. is Further described 
as a stand-alone, one-story house, located near the intersection of Battle Row and Walker Street. 
It is a red brick house with a shingle roof. The numbers 1957 arc visible on the residence. The 
front door is covered by a front porch. 

The vehicle to be searched in a light-colored Nissan Cube with VIN 
JN8AZ2KR0CT254476, co-registcred to REALITY LEIGH WINNER. 

The person to be searched is REALITY LEIGH WINNER, who is a white female with 
blonde hair and blue eyes, 5'5" tall, weighing approximately 145 pounds, with DOB December 
4, 1991. 
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ATTACHMENT B 

Properly to he seized 

I. All documents and records relating to violations of 18 U.S.C. § 793, 
involving REALITY LEIGH WINNER and occurring after January 1,2013, including: 

a. Classified material; 

b. Any U.S. Government material: 

c. Contacts, by any means, with foreign governments, foreign powers, or 

agents of foreign powers; 

d. Contacts, by any means, with media outlets: 

e. Information, including communications in any form, regarding the 
retrieval, storage, or transmission of sensitive or classified material; 

f. Records of travel, including calendars, travel tickets, receipts, and 
photographs; 

g. Information regarding iradecraft. how to obtain or deliver sensitive 
information, and/or how to avoid or evade detection by intelligence officials or law 
enforcement authorities; 

h. Financial records, including bank statements, account information and 
records of any financial transaction; 

i. Information relevant to a motive for the offense, such as anti-government 
statements, propaganda, research, and solicitations or offers to engage in anti-government 
or unlawful activities. 

2. Computers or storage media used as a means to commit the violations described 
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above. 

3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat," instant messaging 
logs, photographs, and correspondence: 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software: 

c. evidence of the lack of such malicious software: 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use. and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user's stale of mind as it relates to the crime under 

investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used: 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER'S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses: 

m. contextual information necessary to understand the evidence described in this 
attachment. 

4. Routers, modems, and network equipment used to connect computers to the 
Internet. 

As used above, the terms “records" and “information" includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 


6 




mmm ete 


iiM 62 


videotapes, motion pictures, or photocopies). 

The term “documents” means records, notes, letters, correspondence, forms, financial 
records, checks, ledgers, accounting papers, computer printouts, saved e-mail, information on 
computer hard drives and disks, computer input and output reports, and writings, and any other 
item of any type that conveys information. 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM. floppy disks, flash memory. CD-ROMs, and 
other magnetic or optical media. 
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person contain evidence, contraband, fruits, and/or other items illegally possessed in violation of 
18 U.S.C.§ 793(e). 

4. The facts set forth in this affidavit are based on my personal knowledge, 
knowledge obtained during my participation in this investigation, and information from other 
FBI and U.S. Government personnel. This affidavit is intended to show only that there is 
sufficient probable cause for the requested warrant and docs not set forth all of my knowledge 
about this matter. 

STATUTORY AUTHORITY AND DEFINITIONS 

5. For the reasons set forth below, I believe that there is probable cause to believe that 
the PREMISES. VEHICLE, and WINNER'S person contain evidence, contraband, fruits, and/or 
other items illegally possessed in violation of Title 18, United States Code, Section 793(e) (the 
•‘Subject Offense*'). 

6. Under 18 U.S.C. § 793(e), "whoever having unauthorized possession of, access to, 
or control over any document... or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the United States or 
to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be 
communicated, delivered, or transmitted" or attempts to do or causes the same “to any person not 
entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee 
of the United States entitled to receive it" shall be fined or imprisoned not more than ten years, or 
both. 

7. Under Executive Order 13526. information in any form may be classified if it: (1) 


is owned by, produced by or for, or is under the control of the United States Government; (2) falls 
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within one or more of the categories set Forth in the Executive Order [Top Secret, Secret, and 
Confidential]; and (3) is classified by an original classification authority who determines that its 
unauthorized disclosure reasonably could be expected to result in damage to the national security. 

8. Where such unauthorized disclosure could reasonably result in damage to the 
national security, the information may be classified as '‘Confidential’* and must be properly 
safeguarded. Where such unauthorized disclosure could reasonably result in serious damage to 
the national security, the information may be classified as “Secret" and must be properly 
safeguarded. Where such unauthorized disclosure could reasonably result in exceptionally grave 
damage to the national security, the information may be classified as 'Top Secret” and must be 
properly safeguarded. 

9. Classified information of any designation may be shared only with persons 
determined by an appropriate United States Government official to be eligible for access, and who 
possess a “need to know.” Among other requirements, in order for a person to obtain a security 
clearance allowing that person access to classified United States Government information, that 
person is required to and must agree to properly protect classified information by not disclosing 
such information to persons not entitled to receive it, by not unlawfully removing classified 
information from authorized storage facilities, and by not storing classified information in 
unauthorized locations. If a person is not eligible to receive classified information, classified 
information may not be disclosed to that person. In order for a foreign government to receive 
access to classified information, the originating United Stales agency must determine that such 
release is appropriate. 

10. Pursuant to Hxeculivc Order 13526, classified information contained on automated 



information systems, including networks and telecommunications systems, that collect, create, 
communicate, compute, disseminate, process, or store classified information must be maintained 
in a manner that: (1) prevents access by unauthorized persons: and (2) ensures the integrity of the 
information. 

11. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. 
Specifically, 32 C.F.R. § 2001.43. tilled “Storage," regulates the physical protection of classified 
information. This section prescribes that Secret and Top Secret information “shall be stored in a 
GSA-approved security container, a vault built to Federal Standard (FHD STD) 832, or an open 
storage area constructed in accordance with § 2001.53." It also requires periodic inspection of the 
container and the use of an Intrusion Detection System, among other things. 

PROBABLE CAUSE 

12. As set forth in further detail below, WINNER is under investigation for printing 
and improperly removing and transmitting classified material from an Intelligence Community 
Agency (the “U.S. Government Agency") on or about May 9, 20)7. and passing the classified 
material to an online news outlet (the “News Outlet”). WINNER is a contractor with Pluribus 
International Corporation assigned to a U.S. Government Agency facility in Georgia. She has 
been employed at the facility since on or about February 13.2017. From January 2013 until her 
employment with Pluribus International Corporation. WINNER was an active duty member of 
the U.S. Air Force and held a Top Secret clearance. 

13. On June 1,2017, the FBI was notified by the U.S. Government Agency that the 
U.S. Government Agency had been contacted by the News Outlet on May 30,2017, regarding an 
upcoming story. The News Outlet informed the U.S Government Agency that it was in 
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possession of what it believed to be a classified document authored by the U.S Government 
Agency. The News Outlet provided the U.S. Government Agency with a copy of this document. 
Subsequent analysis by the U.S. Government Agency confirmed that the document in the News 
Outlet's possession is intelligence reporting dated on or about May 5.2017 (the ‘intelligence 
reporting”). This intelligence reporting is classified at the Top Secret level, indicating that its 
unauthorized disclosure could reasonably result in exceptionally grave damage to the national 
security, and is marked as such. The U.S. Government Agency has since confirmed that the 
reporting contains information that was classified at that level at the time that the reporting was 
published on or about May 5,2017, and that such information currently remains classified at that 
level. 

14. The U.S. Government Agency examined the document shared by the News Outlet 
and determined the pages of the intelligence reporting appeared to be folded and/or creased, 
suggesting they had been printed and hand-carried out of a secured space. 

15. The U.S. Government Agency conducted an internal audit to determine who 
accessed the intelligence reporting since its publication. The U.S. Government Agency 
determined that six individuals printed this reporting. These six individuals included WINNER. 

A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact 
with the News Outlet. The audit did not reveal that any of the other individuals had e-mail contact 
with the News Outlet. 

16. The U.S. Government Agency determined that WINNER had e-mail 
communication with the News Outlet on or about March 30.2017, and March 31,2017. The first 
e-mail was from WINNER, using e-mail address da3rc.fitness@gmail.com, to the News Outlet. 
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In it, WINNER appeared to request transcripts of a podcast. The second e-mail was from the 
News Outlet to da3re.fitness@gmail.com and confirmed WINNER’S subscription to the service. 
The da3re.fitness@gmail.com account is a personal e-mail account not sponsored by or affiliated 
with the U.S. Government Agency. 

17. On or about May 9.2017. four days after the publication of the classified report, 
WINNER conducted searches on the U.S. Government Agency’s classified system for certain 
search terms, which led WINNER to identify the intelligence reporting. On or about May 9, 

2017, WINNER also printed the intelligence reporting. A review of WINNER’S computer history 
revealed she did not print any other intelligence report in May 2017. 

18. At all times relevant to this affidavit. WINNER has maintained an active Top 
Secret clearance. The U.S. Government Agency confirmed that although WINNER had the 
required access to search for and view the intelligence reporting, the information contained in the 
intelligence reporting is unrelated to her job duties, and WINNER therefore does not possess a 
•’need to know.” 

19. On or about May 24,2017, a reporter for the News Outlet (the “Reporter”) 
contacted another U.S. Government Agency affiliate with whom he has a prior relationship. This 
individual works for a contractor for the U.S. Government (the “Contractor”). The Reporter 
contacted the Contractor via text message and asked him to review certain documents. The 
Reporter told the Contractor that the Reporter had received the documents through the mail, and 
they were postmarked “Augusta. Georgia." WINNER resides in Augusta, Georgia. The Reporter 
believed that the documents were sent to him from someone working at the location where 
WINNER works. The Reporter took pictures of the documents and sent them to the Contractor. 
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The Reporter asked the Contractor to determine the veracity of the documents. The Contractor 
informed the Reporter that he thought that the documents were fake. Nonetheless, the Contractor 
contacted the U.S. Government Agency on or about June 1,2017. to inform the U.S. Government 
Agency of his interaction with the Reporter. Also on June t. 2017, the Reporter texted the 
Contractor and said that a U.S Government Agency official had verified that the document was 
real. When questioned about what intelligence report number was associated with the images on 
his phone, the Contractor supplied the reporting number associated with the intelligence reporting 
at issue. 

20. On May 27 to 29,2017, WINNER traveled outside the United States to Belize in 
Central America. WINNER provided notice to the U.S. Government Agency in March 2017 of 
her intent to travel to Belize in May 2017. The purpose of WINNER’S travel and her activities 
while abroad arc unknown. 

21. WINNER resides at the PREMISES, as verified on June 2, 2017, by her Driver’s 
License address and two utility billing addresses. Additionally, WINNER owns and drives a 
light-colored Nissan Cube with VIN JN8AZ2KR0CT254476. as verified by the vehicle 
registration information. Agents viewed a light-colored Nissan Cube parked at the PREMISES on 
June 2,2017. and witnessed WINNER traveling in the VEHICLE in Augusta, Georgia, on June 3. 
2017. I confirmed on June 2.2017. that WINNER has a cellular phone serviced by 
Cingular/AT&T. In my training and experience, people typically store their electronics and 
correspondence (including letters or printed emails) in their homes and transport them in their 
vehicles. I also know that people typically carry small electronic storage devices and 
communication devices, such as thumb drives and cellular phones, on their person. There is thus 
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probable cause to believe that intelligence reporting and evidence of correspondence between 
WINNER and the News Outlet, among other items of evidentiary value, may be found inside the 
PREMISES and the VEHICLE, as well as on storage and communication devices on WINNER’S 
person. Moreover, there is probable cause to believe that evidence of communications between 
WINNER and the News Outlet, among other items of evidentiary value, will be found on 
WINNER'S electronic devices at the PREMISES, in the VEHICLE, and on WINNER’S person. 

COMPUTERS, ELECTRONIC STORAGE, ANI) FORENSIC ANALYSIS 

22. As described in Attachment I), this application seeks permission to search for 
records that might be found on the PREMISES, in the VEHICLE, and on WINNER’S person, in 
whatever form they are found. One form in which the records might be found is data stored on a 
computer's hard drive or other storage media. Thus, the warrant applied for would authorize the 
seizure of electronic storage media or, potentially, the copying of electronically stored 
information, all under Rule 41 (e)(2)(B). 

23. Probable cause. I submit that if a computer or storage medium is found on the 
PREMISES, in the VEHICLE, or on WINNER'S person, there is probable cause to believe those 
records will be stored on that computer or storage medium, lor at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic 
files downloaded to a storage medium can be stored for years at little or no cost. 
Even when files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes’' a file on a 
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computer, the data contained in the file docs not actually disappear; rather, that 
data remains on the storage medium until it is overwritten by new data. 

b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space, that is, in space on the storage medium that is not currently being 
used by an active file.. for long periods of lime before they are overwritten. In 
addition, a computer's operating system may also keep a record of deleted data in 
a “swap" or “recovery" file. 

c. Wholly apart from user-generated files, computer storage media - in particular, 
computers' internal hard drives • contain electronic evidence of how a computer 
has been used, what it has been used for. and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and virtual memory “swap" or paging flies. Computer 
users typically do not erase or delete this evidence, because special software is 
typically required for that task. I lowcvcr, it is technically possible to delete this 
information. 

d. Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache." 

24. Forensic evidence. As further described in Attachment I), this application seeks 

permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how computers 
were used, the purpose of their use, who used them, and when. 1'hcre is probable cause to believe 
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that this forensic electronic evidence will be on any storage medium in the PREMISES, in the 
VEHICLE, or on WINNER’S person because: 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 

Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB I lash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified, 
b. As explained herein, information stored within a computer and other 
electronic storage media may provide crucial evidence of the “who, what, why, 
when, where, and how” of the criminal conduct under investigation, thus enabling 
the United States to establish and prove each clement or alternatively, to exclude 
the innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (c.g., registry information, 
communications, images and movies, transactional information, records of session 
times and durations, internet history, and anti-virus, spyware, and malware 
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detection programs) can indicate who has used or controlled the computer or 
storage media. This "user attribution" evidence is analogous to the search for 
"indicia of occupancy" while executing a search warrant at a residence. The 
existence or absence of anti-virus, spyware, and malware detection programs may 
indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity can 
indicate how and when the computer or storage media was accessed or used, for 
example, as described herein, computers typically contain information that log: 
computer user account session times and durations, computer activity associated 
with user accounts, electronic storage media that connected with the computer, and 
the IP addresses through which the computer accessed networks and the internet. 
Such information allows investigators to understand the chronological context of 
computer or electronic storage media access, use, and events relating to the crime 
under investigation. Additionally, some information stored within a computer or 
electronic storage media may provide crucial evidence relating to the physical 
location of other evidence and the suspect. For example, images stored on a 
computer may both show a particular location and have gcolocation information 
incorporated into its file data. Such file data typically also contains information 
indicating when the file or image was created. The existence of such image files, 
along with external device connection logs, may also indicate the presence of 
additional electronic storage media (e.g., a digital camera or cellular phone with an 
incorporated camera). The geographic and timeline information described herein 
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may either inculpate or exculpate the computer user. Last, information stored 
within a computer may provide relevant insight into the computer user’s state of 
mind as it relates to the offense under investigation. For example, information 
within the computer may indicate the owner’s motive and intent to commit a crime 
(e.g., internet searches indicating criminal planning), or consciousness of guilt 
(e.g., running a “wiping" program to destroy evidence on the computer or 
password protecting/encrypting such evidence in an effort to conceal it from law 
enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact tiles, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can be 
merely reviewed by a review team and passed along to investigators. Whether data 
stored on a computer is evidence may depend on other information stored on the 
computer and the application of knowledge about how a computer behaves. 
Therefore, contextual information necessary to understand other evidence also falls 
within the scope of the warrant. 

c. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular thing 
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is not present on a storage medium. For example, the presence or absence of 
counter-forensic programs or anti-virus programs (and associated data) may be 
relevant to establishing the user's intent. 

25. Necessity of seizing or copying entire computers or storage media. In most cases, 

a thorough search of a premises or vehicle for information that might be stored on storage media 
often requires the seizure of the physical storage media and later off-site review consistent with 
the warrant. In lieu of removing storage media from the premises or vehicle, it is sometimes 
possible to make an image copy of storage media. Generally speaking, imaging is the taking of a 
complete electronic picture of the computer’s data, including all hidden sectors and deleted files. 
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data 
recorded on the storage media, and to prevent the loss of the data either from accidental or 
intentional destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing evidence 
of how a computer has been used, what it has been used for, and who has used it 
requires considerable time, and taking that much time on premises could be 
unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 
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b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on the search site. The vast array of computer hardware 
and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

26. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 

CONCLUSION 

27. I submit that this affidavit supports probable cause for a warrant to search the 
PREMISES, the VEHICLE, and the PERSON described in Attachment A and seize the items 
described in Attachment B. 
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REQUEST FOR SEALING 

28. It is respectfully requested that this Court issue an order sealing, until further order 
of the Court, all papers submitted in support of this application, including the application and 
search warrant. I believe that sealing this document is necessary because the items and 
information to be seized are relevant to an ongoing investigation and the FBI has not yet identified 
ail potential criminal confederates nor located all evidence related to its investigation. Premature 
disclosure of the contents of this affidavit and related documents may have a significant and 
negative impact on the continuing investigation and may severely jeopardize its effectiveness by 
allowing criminal parlies an opportunity to flee, destroy evidence (stored electronically and 
otherwise), change patterns of behavior, and notify criminal confederates. 


Respectfully submitted. 



Jusdh- 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me 
on June 3. 2017: 



IIII: 


BRIAN K. I-PPS 


UNITED STATES'MAGISTRATE JUDGE! 
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AO 91 (Rev. ll/ll) Criminal Complaint 


United States District Court 

for the 

Southern District of Georgia 

United States of America 
v. 

REALITY LEIGH WINNER 


Defemknt(s) 

CRIMINAL COMPLAINT 

1, the complainant in this case, state that the following is true to the best of my knowledge and belief. 

On or about the date(s) of _ May 9,2017 _in the county of Augusta-Richmond _in the 

Southern District of _ Georgia _, the defendant(s) violated: 

Code Section Offense Description 

18 U.S.C. Section 793(e) Gathering, Transmitting or Losing Defense Information 


) 

) 

) Case No. 

) 1;17-MJ-024 

) 

) 

) 


This criminal complaint is based on these facts: 
See attached affidavit. 

fff Continued on the attached sheet. 

Sworn to before me and signed in my presence. 
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Date: 06/05/2017 

City and state: _ Augusta, Georgia _ 



Printed name and title 



Printed name and title 






















AFFIDAVIT IN SUPPORT OF APPLICATION FOR ARREST WARRANT 

I, Justin C. Garrick, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
the Atlanta division, and have been since 2008. During this time, I have received training at the 
FBI Academy located at Quantico, Virginia, specific to counterintelligence and espionage 
investigations. I currently am assigned to investigate counterintelligence and espionage matters. 
Based on my experience and training, I am familiar with efforts used to unlawfully collect and 
disseminate sensitive government information, including national defense information. 

2. Your affiant is currently investigating the activities of REALITY LEIGH 
WINNER (“WINNER”), whom your affiant believes willfully retained and transmitted classified 
national defense information to a person not entitled to receive it in violation of 18 U.S.C. § 
793(e). These acts occurred in Augusta, Georgia, which is located within the Southern District of 
Georgia. Your affiant submits this complaint in support of the arrest of WINNER. 

3. The facts in this affidavit come from your affiant’s personal observations, training 
and experience, and information obtained from other U.S. Government officers, agents, and 
witnesses. This affidavit is intended to show merely that there is sufficient probable cause for 
WINNER’S arrest and does not set forth all of your affiant’s knowledge about this matter. 

STATUTORY AUTHORITY AND DEFINITIONS 

4. For the reasons set forth below, I believe that there is probable cause to believe 
that WINNER committed a violation of Title 18, United States Code, Section 793(e). 
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5. Under 18 U.S.C. § 793(e), “whoever having unauthorized possession of, access to, 
or control over any document ... or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the United States or 
to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be 
communicated, delivered, or transmitted” or attempts to do or causes the same “to any person not 
entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee 
of the United States entitled to receive it” shall be fined or imprisoned not more than ten years, or 
both. 

6. Under Executive Order 13526, information in any form may be classified if it: (1) 
is owned by, produced by or for, or is under the control of the United States Government; (2) falls 
within one or more of the categories set forth in the Executive Order [Top Secret, Secret, and 
Confidential]; and (3) is classified by an original classification authority who determines that its 
unauthorized disclosure reasonably could be expected to result in damage to the national security. 

7. Where such unauthorized disclosure could reasonably result in damage to the 
national security, the information may be classified as “Confidential” and must be properly 
safeguarded. Where such unauthorized disclosure could reasonably result in serious damage to 
the national security, the information may be classified as “Secret” and must be properly 
safeguarded. Where such unauthorized disclosure could reasonably result in exceptionally grave 
damage to the national security, the information may be classified as “Top Secret” and must be 
properly safeguarded. 
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8. Classified information of any designation may be shared only with persons 
determined by an appropriate United States Government official to be eligible for access, and 
who possess a “need to know.” Among other requirements, in order for a person to obtain a 
security clearance allowing that person access to classified United States Government 
information, that person is required to and must agree to properly protect classified information 
by not disclosing such information to persons not entitled to receive it, by not unlawfully 
removing classified information from authorized storage facilities, and by not storing classified 
information in unauthorized locations. If a person is not eligible to receive classified information, 
classified information may not be disclosed to that person. In order for a foreign government to 
receive access to classified information, the originating United States agency must determine that 
such release is appropriate. 

9. Pursuant to Executive Order 13526, classified information contained on automated 
information systems, including networks and telecommunications systems, that collect, create, 
communicate, compute, disseminate, process, or store classified information must be maintained 
in a manner that: (1) prevents access by unauthorized persons; and (2) ensures the integrity of the 
information. 

10. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. 
Specifically, 32 C.F.R. § 2001.43, titled “Storage,” regulates the physical protection of classified 
information. This section prescribes that Secret and Top Secret information “shall be stored in a 
GSA-approved security container, a vault built to Federal Standard (FHD STD) 832, or an open 
storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of the 
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container and the use of an Intrusion Detection System, among other things. 

PROBABLE CAUSE 

11. WINNER is a contractor with Pluribus International Corporation assigned to a 

U.S. Government Agency facility in Georgia. She has been employed at the facility since on or 
about February 13,2017, and has held a Top Secret clearance during that time. As set forth in 
further detail below, on or about May 9, 2017, WINNER printed and improperly removed 
classified intelligence reporting, which contained classified national defense information and 
was dated on or about May 5, 2017 (the “intelligence reporting”) from an Intelligence 
Community Agency (the “U.S. Government Agency”) and unlawfully retained it. 
Approximately a few days later, WINNER then unlawfully transmitted the intelligence 
reporting to an online news outlet (the “News Outlet”). 

12. On June 1, 2017, the FBI was notified by the U.S. Government Agency that the 
U.S. Government Agency had been contacted by the News Outlet on May 30,2017, regarding an 
upcoming story. The News Outlet informed the U.S. Government Agency that it was in 
possession of what it believed to be a classified document authored by the U.S. Government 
Agency. The News Outlet provided the U.S. Government Agency with a copy of this document. 
Subsequent analysis by the U.S. Government Agency confirmed that the document in the News 
Outlet’s possession is the intelligence reporting. The intelligence reporting is classified at the 
Top Secret level, indicating that its unauthorized disclosure could reasonably result in 
exceptionally grave damage to the national security, and is marked as such. The U.S. 
Government Agency has since confirmed that the reporting contains information that was 
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classified at that level at the time that the reporting was published on or about May 5, 2017, and 
that such information currently remains classified at that level. 

13. The U.S. Government Agency examined the document shared by the News Outlet 
and determined the pages of the intelligence reporting appeared to be folded and/or creased, 
suggesting they had been printed and hand-carried out of a secured space. 

14. The U.S. Government Agency conducted an internal audit to determine who 
accessed the intelligence reporting since its publication. The U.S. Government Agency 
determined that six individuals printed this reporting. WINNER was one of these six individuals. 
A further audit of the six individuals’ desk computers revealed that WINNER had e-mail contact 
with the News Outlet. The audit did not reveal that any of the other individuals had e-mail 
contact with the News Outlet. 

15. On June 3,2017, your affiant spoke to WINNER at her home in Augusta, Georgia. 
During that conversation, WINNER admitted intentionally identifying and printing the classified 
intelligence reporting at issue despite not having a “need to know,” and with knowledge that the 
intelligence reporting was classified. WINNER further admitted removing the classified 
intelligence reporting from her office space, retaining it, and mailing it from Augusta, Georgia, to 
the News Outlet, which she knew was not authorized to receive or possess the documents. 
WINNER further acknowledged that she was aware of the contents of the intelligence reporting 
and that she knew the contents of the reporting could be used to the injury of the United States 
and to the advantage of a foreign nation. 
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CONCLUSION 

16. Your affiant submits that the facts set forth in this affidavit establish probable 
cause to believe WINNER committed a violation of 18 U.S.C. Section 793(e). Therefore, your 
affiant respectfully requests this Court issue an arrest warrant for WINNER. 


Respectfully submitted, 



JusKn u. uarrici 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me 
on June 5,2017: 



UNITED STATES MAGISTRATE JUDGE 
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